Fore Reports Customer Data Breach to Komdigi: Here Are the Potential Sanctions

Jakarta, CNBC Indonesia — The Ministry of Communication and Digital Affairs (Komdigi) said Fore reported a suspected data breach on 28 October 2026. Komdigi is analysing the case and conducting an examination.

“PT Fore Kopi Indonesia Tbk reported a suspected failure to protect personal data to Komdigi on 28 October 2026. Following that report, Komdigi is currently conducting further analysis and examination,” Muchtarul Huda, Director of Digital Space Supervision Strategy and Policy at Komdigi, said in an official statement cited on Thursday (5 November 2026).

He said that negligence or a breach of personal data protection obligations could result in administrative measures and/or sanctions under the applicable regulations.

However, sanctions cannot yet be imposed, he said, because no decision can be made before the examination is complete.

“Determining the parties responsible for the alleged violation and imposing administrative sanctions will be based on the results of the examination and the evidence. Therefore, the parties to be sanctioned and the type of administrative sanction to be applied cannot be determined before the examination is complete,” he said.

The case has also raised questions about the status of the personal data protection supervisory body, which has yet to be established. Muchtarul said the draft presidential regulation on establishing the body is in its final stage and has been submitted to the President through the Ministry of State Secretariat.

“Komdigi has also prepared a dedicated task force to ensure the transition process runs smoothly,” he said.

Fore previously said it had found unauthorised access to one of the company’s data management platforms. Its initial investigation found that 5.7 million customer accounts had been affected.

The illegal access was immediately stopped and the system secured within 24 hours of the activity being identified.